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I. Real Party in Interest 

The real party in interest of the present application, solely for purposes of 
identifying and avoiding potential conflicts of Interest by board members due to working 
in matters in which the member has a financial interest, is Verizon Communications Inc. 
and its subsidiary companies, which currently include Verizon Business Global, LLC 
(formerly MCI, LLC) and Celico Partnership (doing business as Verizon Wireless, and 
which includes as a minority partner affiliates of Vodafone Group Pic). Verizon 
Communications Inc. or one of its subsidiary companies is an assignee of record of the 
present application. 
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II. Related Appeals and Interferences 

There are currently no other appeals or interferences, of which Appellant, 
Appellant's legal representative, or the assignee are aware, that will directly affect or be 
directly affected by or have a bearing on the Board's decision in the pending appeal. 
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III. Status of Claims 

Claims 2-1 1,16, 18-28, 33-43, 48-50, and 52 stand as rejected, and claims 1 , 
12-15, 17, 29-32, 44-47, and 51 have been canceled. No claim is allowed or objected 
to. The final rejection of claims 2-11, 16, 18-28, 33-43, 48-50, and 52 is being 
appealed. A list of the claims on appeal is found in the attached Claims Appendix. 
Furthermore, each pending claim of this patent application is separately patentable, and 
upon issuance of a patent will be entitled to a separate presumption of validity under 
35 U.S.C. § 282. 
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IV. Status of Amendments 

No amendment was filed subsequent to the Final Office Action mailed on 
October 5, 2009. 
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V. Summary of Claimed Subiect Matter 

The following summary of the presently claimed subject matter indicates certain 
portions of the specification (including the drawings) that provide examples of 
embodiments of elements of the claimed subject matter. It is to be understood that 
other portions of the specification not cited herein may also provide examples of 
embodiments of elements of the claimed subject matter. It is also to be understood that 
the indicated examples are merely examples, and the scope of the claimed subject 
matter includes alternative embodiments and equivalents thereof. References herein to 
the specification are thus intended to be exemplary and not limiting. 

Independent claim 2 is directed to a method for detecting a wireless access 
device on a network. See, for example, specification at paragraph 006 and Fig. 1 . The 
method includes storing one or more organizationally unique identifiers that comprise 
the first three octets of one or more registered addresses. See, for example, 
specification at paragraphs 038, 051 , and 052; and Fig. 1 , ref. 1 100. The method 
includes receiving from the network a packet with an address. See, for example, 
specifidation at paragraphs 027, 035, and 041 ; and Fig. 1 , ref. 1 100. The method 
includes searching the identifiers, wherein a more frequently encountered 
predetemnined percentage of identifiers is searched first. See, for example, 
specification at paragraphs 027, 041 , and 057; and Fig. 1 , ref. 1 100. The method also 
includes comparing the first three octets of the received address with the identifiers. 
See, for example, specification at paragraphs 051 and 052; and Fig. 1 , ref. 1 100. 

The method also includes detemiining if the received address includes one of the 
stored identifiers. See, for example, specification at paragraphs 027 and 041 ; and Fig. 
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1 , ref. 1 100. The method also includes determining an operating system associated 

with the received address, when comparing the received address results in a match 

between the received address and at least one of the registered addresses. See, for 

example, specification at paragraphs 027 and 041; and Fig. 1, ref. 1 100. The method 

also includes comparing the determined operating system with one or more stored 

operating systems, such that at least one of the stored operating systems corresponds 

to the wireless access device. See, for example, specification at paragraphs 027 and 

041 ; and Fig. 1 , ref. 1 100. The method further includes indicating that the received 

packet corresponds to the wireless access device based on the first three octets of the 

received address and when the determined operating system matches at least one of 

the stored operating systems. See, for example, specification at paragraphs 027 and 

041; and Fig. 1, ref. 1100. 

Independent claim 18 is directed to a system for detecting a wireless access 

device on a network. See, for example, specification at paragraph 006 and Fig. 1 . The 

system includes a means for storing one or more organizationally unique identifiers that 

comprise the first three octets of one or more registered addresses. See, for example, 

specification at paragraphs 038, 051, and 052; and Fig. 1, ref. 1 100. The system 

includes a means for receiving from the network a packet with an address. See, for 

example, specification at paragraphs 027, 035, and 041 ; and Fig. 1 , ref. 1 100. The 

system includes a means for searching the identifiers, wherein a more frequently 

encountered predetermined percentage of identifiers is searched first. See, for 

example, specification at paragraphs 027, 041, and 057; and Fig. 1, ref. 1100. The 

system also includes a means for comparing the first three octets of the received 
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address with the identifiers. See, for example, specification at paragraphs 051 and 052; 
and Fig. 1, ref. 1100. 

The system also includes a means for determining if the received address 
includes one of the stored identifiers. See, for example, specification at paragraphs 027 
and 041 ; and Fig. 1 , ref. 11 00. The system also includes a means for determining an 
operating system associated with the received address, when comparing the received 
address results in a match between the received address and at least one of the 
registered addresses. See, for example, specification at paragraphs 027 and 041 ; and 
Fig. 1 , ref. 1 100. The system also includes a means for comparing the determined 
opeiBting system with one or more stored operating systems, such that at least one of 
the stored operating systems corresponds to the wireless access device. See, for 
example, specification at paragraphs 027 and 041 ; and Fig. 1 , ref. 1 100. The system 
further includes a means for indicating that the received packet corresponds to the 
wireless access device based on the first three octets of the received address and when 
the determined operating system matches at least one of the stored operating systems. 
See, for example, specification at paragraphs 027 and 041 ; and Fig. 1 , ref. 1 100. 

Independent claim 19 is directed to a system for detecting a wireless access 
device on a network. See, for example, specification at paragraph 006 and Fig. 1 . The 
system includes at least one memory. See, for example, specification at paragraphs 
029-034; Fig. 1 , ref. 1110; and Fig. 2, ref. 2000. The memory includes code that stores 
one or more organizationally unique identifiers that comprise the first three octets of one 
or more registered addresses. See, for example, specification at paragraphs 038, 051 , 
and 052; and Fig. 1 , ref. 1 100, The memory includes code that receives from the 
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network a packet with an address. See, for example, specification at paragraphs 027, 
035, and 041 ; and Fig. 1 , ref. 1 100. The memory includes code that searches the 
identifiers, wherein a more frequently encountered predetermined percentage of 
identifiers is searched first. See, for example, specification at paragraphs 027, 041 , and 
057; and Fig. 1 , ref. 1 100. The memory also includes code that compares the first three 
octets of the received address with the identifiers. See, for example, specification at 
paragraphs 051 and 052; and Fig. 1, ref. 1100. 

The memory also includes code that determines if the received address includes 
one of the stored identifiers. See, for example, specification at paragraphs 027 and 
041 ; and Fig. 1 , ref. 1 100. The memory also includes code that determines an 
operating system associated with the received address, when comparing the address 
results in a match between the received address and at least one of the registered 
addresses. See, for example, specification at paragraphs 027 and 041 ; and Fig. 1 , ref. 
1 100. The memory also includes code that compares the determined operating system 
with one or more stored operating systems, such that at least one of the stored 
operating systems corresponds to the wireless access device. See, for example, 
specification at paragraphs 027 and 041 ; and Fig. 1 , ref. 1 100. The memory further 
includes code that indicates that the received packet corresponds to the wireless 
access device based on the first three octets of the received address and when the 
determined operating system matches at least one of the stored operating systems. 
See, for example, specification at paragraphs 027 and 041 ; and Fig. 1 , ref. 1 100. The 
system includes at least one data processor that executes the code. See, for example, 
specification at paragraphs 029-034; Fig. 1, ref. 1110; and Fig. 2, ref. 2000. 
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Independent claim 34 is directed to a computer program product, tangibly 
embodied in a computer-readable storage medium, for detecting a wireless access 
device on a network. See, for example, specification at paragraph 006 and Fig. 1 . The 
computer program product includes code that stores one or more organizationally 
unique identifiers that comprise the first three octets of one or more registered 
addresses. See, for example, specification at paragraphs 038, 051 , and 052; and Fig. 
1 , ref. 1 100. The computer program product includes code that receives from the 
network a packet with an address. See, for example, specification at paragraphs 027, 
035, and 041 ; and Fig. 1 , ref. 1 100. The computer program product includes code that 
searches the identifiers, wherein a more frequently encountered predetermined 
percentage of identifiers is searched first. See, for example, specification at paragraphs 
027, 041 , and 057; and Fig. 1 , ref. 1 100. The computer program product includes code 
that compares the first three octets of the received address with the identifiers. See, for 
example, specification at paragraphs 051 and 052; and Fig. 1, ref. 1100. 

The computer program product also includes code that detennines if the received 
address includes one of the stored identifiers. See, for example, specification at 
paragraphs 027 and 041 ; and Fig. 1 , ref. 1 100. The computer program product also 
includes code that determines an operating system associated with the received 
address, when comparing the address results in a match between the received address 
and at least one of the registered addresses. See, for example, specification at 
paragraphs 027 and 041 ; and Fig. 1 , ref. 1 100. The computer program product also 
includes code that compares the determined operating system with one or more stored 
operating systems, such that at least one of the stored operating systems corresponds 
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to the wireless access device. See, for example, specification at paragraphs 027 and 

041 ; and Fig. 1 , ref. 1 100. The computer program product also includes code that 

indicates that the received packet corresponds to the wireless access device based on 

the first three octets of the received address and when the determined operating system 

matches at least one of the stored operating systems. See, for example, specification 

at paragraphs 027 and 041; and Fig. 1, ref. 1100. The computer program product 

further includes at least one data processor that executes the code. See, for example, 

specification at paragraphs 029-034; Fig. 1 , ref. 1110; and Fig. 2, ref. 2000. 

Independent claim 49 is directed to a system including a network and a 

processor connected to the network. See, for example, specification at paragraphs 006, 

021 , and 025; and Fig. 1 , refs. 1200 and 1110. The processor includes a means for 

storing one or more organizationally unique identifiers that comprise the first three 

octets of one or more registered addresses. See, for example, specification at 

paragraphs 038, 051 , and 052; and Fig. 1 , ref. 1110. The processor includes a means 

for receiving a packet with an address from a wireless access device on the network. 

See, for example, specification at paragraphs 027, 035, and 041 ; and Fig. 1 , ref. 1110. 

The processor also includes a means for searching the identifiers, wherein a more 

frequently encountered predetermined percentage of identifiers is searched first. See, 

for example, specification at paragraphs 027, 041 , and 057; and Fig. 1 , ref. 1110. The 

processor also includes a means for comparing the first three octets of the received 

address with the identifiers. See, for example, specification at paragraphs 051 and 052; 

and Fig. 1, ref. 1110. 
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The processor also includes a means for determining if the received address 
includes one of the stored identifiers. See, for example, specification at paragraphs 027 
and 041 ; and Fig. 1 , ref. 1 1 1 0. The processor also includes a means for determining an 
operating system associated with the received address, when comparing the received 
address results in a match between the received address and at least one of the 
registered addresses. See, for example, specification at paragraphs 027 and 041 ; and 
Fig. 1 , ref . 1 1 1 0. The processor also includes a means for comparing the determined 
operating system with one or more stored operating systems, such that at least one of 
the stored operating systems corresponds to the wireless access device. See, for 
example, specification at paragraphs 027 and 041; and Fig. 1 , ref. 1110. The processor 
further includes a means for indicating that the received packet corresponds to the 
wireless access device based on the first three octets of the received address and when 
the determined operating system matches at least one of the stored operating systems. 
See, for example, specification at paragraphs 027 and 041 ; and Fig. 1 , ref. 1110. 

Independent claim 50 is directed to a system including a network, a first 
processor interfaced to the network, and a second processor interfaced to the network. 
See, for example, specification at paragraphs 021 and 023-025; and Fig. 1, refs. 1 100, 
1200, and 1400. The second processor stores one or more organizationally unique 
identifiers that comprise the first three octets of one or more registered addresses. See, 
for example, specification at paragraphs 038, 051, and 052; and Fig. 1, ref. 1100. The 
second processor receives a packet with an address from the first processor via the 
network. See, for example, specification at paragraphs 027, 035, and 041 ; and Fig. 1 , 
ref. 1 100. The second processor also searches the identifiers, wherein a more 
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frequently encountered predetermined percentage of identifiers is searched first. See, 
for example, specification at paragraphs 027, 041 , and 057; and Fig. 1 , ref. 1 100. The 

second processor also compares the first three octets of the received address with the 
identifiers. See, for example, specification at paragraphs 051 and 052; and Fig. 1 , ref. 
1100. 

The second processor also detemiines if the received address includes one of 
the stored identifiers. See, for example, specification at paragraphs 027 and 041 ; and 
Fig. 1 , ref. 1110. The second processor also detemiines an operating system 
associated with the received address, when comparing the received address results in a 
match between the received address and at least one of the registered addresses. 
See, for example, specification at paragraphs 027 and 041 ; and Fig. 1 , ref. 1110. The 
second processor also compares the determined operating system with one or more 
stored operating systems, such that at least one of the stored operating systems 
corresponds to an operating system of the first processor. See, for example, 
specification at paragraphs 027 and 041 ; and Fig. 1 , ref. 1110. The second processor 
further indicates that the first processor corresponds to a wireless access device based 
on the first three octets of the received address and when the determined operating 
system matches at least one of the stored operating systems. See, for example, 
specification at paragraphs 027 and 041 ; and Fig. 1 , ref. 1110. 

Independent claim 52 is directed to a computer program product, tangibly 
embodied in a computer-readable storage medium, for detecting a wireless access 
device on a network and containing instructions which, when executed on a processor, 
perform a method. See, for example, specification at paragraph 006 and Fig. 1 . The 
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method includes storing one or more organizationally unique identifiers that comprise 

the first three octets of one or more registered addresses. See, for example, 

specification at paragraphs 038, 051, and 052; and Fig. 1 , ref. 1 100. The method 

includes receiving from the network a packet with an address. See, for example, 

specification at paragraphs 027, 035, and 041 ; and Fig. 1 , ref. 1 100. The method also 

includes searching the identifiers, wherein a more frequently encountered 

predetermined percentage of identifiers is searched first. See, for example, 

specification at paragraphs 027, 041 , and 057; and Fig. 1 , ref. 1 100. The method also 

includes comparing the first three octets of the received address with the identifiers. 

See, for example, specification at paragraphs 051 and 052; and Fig. 1 , ref. 1 100. 

The method also includes determining if the received address includes one of the 

stored identifiers. See, for example, specification at paragraphs 027 and 041; and Fig. 

1 , ref. 1 100. The method also includes determining an operating system associated 

with the received address, when comparing the received address results in a match 

between the received address and at least one of the registered addresses. See, for 

example, specification at paragraphs 027 and 041 ; and Fig. 1 , ref. 1 100. The method 

also includes comparing the determined operating system with one or more stored 

operating systems, such that at least one of the stored operating systems con-esponds 

to the wireless access device. See, for example, specification at paragraphs 027 and 

041 ; and Fig. 1 , ref. 1 100. The method further includes indicating that the received 

packet corresponds to the wireless access device based on the first three octets of the 

received address and when the detennined operating system matches at least one of 
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the stored operating systems. See, for example, specification at paragraphs 027 and 

041; and Fig. 1, ref. 1100. 
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VI. Grounds of Rejection 

A. Claims 2-5, 7, 1 0, 1 1 , 1 6, 1 8-22, 24, 27, 28, 33-37, 39, 42, 43, 48-50 and 
52 stand rejected under 35 U.S.C. § 103(a) as being unpatentable over U.S. Patent No. 
7,124,197 to Ocepek et al. ("Ocepe/c"), in view of U.S. Patent No. 7,295,524 to Gray et 
al. {^Graf), and further in view of U.S. Patent No. 6,580,712 to Jennings et al. 
("Jenning^); 

B. Claims 6, 23, and 38 stand rejected under 35 U.S.C. § 1 03(a) as being 
unpatentable over Ocepek, Gray, and Jennings, and further in view of U.S. Patent No. 
6,009,423 to Moran {"Morarf); 

C. Claim 8, 25, and 40 stand rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Ocepek, Gray, and Jennings, and further in view of U.S. Patent No. 
7,174,373 to Lausier ("Lausiei"); and 

D. Claims 9, 26, and 41 stand rejected under 35 U.S.C. § 1 03(a) as being 
unpatentable over Ocepek, Gray, Jennings, and lousier, and further in view of U.S. 
Patent Application Publication No. 2003/0101353 to Tarquini et al. {"Tarquinr). 
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VII. Argument 

A. Claims 2-5. 7. 10. 11. 16. 18-22. 24. 27. 28. 33-37. 39. 42. 43. 48-50 and 
52 are not obvious over Oceoek. Gray, and Jennings 

Appellant respectfully traverses the rejection of claims 2-5, 7, 10, 11, 16, 18-22, 
24, 27, 28, 33-37, 39, 42, 43, 48-50 and 52 under 35 U.S.C. § 103(a). A prima facie 
case of obviousness has not been established. 

The key to supporting any rejection under 35 U.S.C. § 103 is the clear 
articulation of the reason(s) why the claimed invention would have been obvious. See 
M.P.E.P. § 2142, 8th Ed., Rev. 6 (Sept. 2007). Such an analysis should be made 
explicit and cannot be premised upon mere conclusory statements. Seejd. "A 
conclusion of obviousness requires that the reference(s) relied upon be enabling in that 
it put the public in possession of the claimed invention." M.P.E.P. § 2145. Furthermore, 
"[t]he mere fact that references can be combined or modified does not render the 
resultant combination obvious unless the results would have been predictable to one of 
ordinary skill in the art" at the time the invention was made. M.P.E.P. § 2143.01(111), 
intemal citation omitted. Moreover, "[i]n detemiining the differences between the prior 
art and the claims, the question under 35 U.S.C. § 103 is not whether the differences 
themselves would have been obvious, but whether the claimed invention as a whole 
would have been obvious." M.P.E.P. § 2141.02(1), intemal citations omitted (emphasis 
in original). In this application, a prima facie case of obviousness has not been 
established because the Office Action has not clearly articulated a reason why one of 
ordinary skill would find the claimed combination obvious in view of the cited reference. 
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In this application, a prima facie case of obviousness has not been established 
because the Examiner has not clearly articulated a reason why one of ordinary skill 
would find the claimed combination obvious in view of the cited references. 

For example, claim 2 recites a method comprising, inter alia: 

storing one or more organizationally unique identifiers that comprise the 
first three octets of one or more registered addresses; 

searching the identifiers, wherein a more frequentiv encountered 
predetermined percentage of identifiers is searched first : 

comparing the determined operating system with one or more stored 
operating systems, such that at least one of the stored operating 
systems corresponds to the wireless access device : and 

indicating that the received packet corresponds to the wireless access 
device based on the first three octets of the received address and 
when the determined operating system matches at least one of the 
stored operating systems. 

(Emphasis added). 

Ocepe/f discloses security device 10 that "passively monitors the data link layer 
for new client devices 24" (col. 5, lines 14-15). 'The source MAC address is dependent 
upon the operating system and hardware of protected sen/ers 16" (col. 7, lines 43-44). 

Any address that may exist in Fig. 6 of Ocepe/f corresponds to the source MAC 
address that depends on senders 16. Accordingly, any packet indication that may exist 
in Ocepe/f indicates that the packet is dependent on servers 1 6, not client devices 24, 
alleged by the Examiner to correspond to the claimed "wireless access device" (Final 
Office Action at page 3). Therefore, neither server 1 6 nor any other component of 
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Ocepe/f corresponds to the claimed "wireless access device," as asserted by the 

Examiner for the reasons below. 

Ref . 20 in Ocepek is a wireless access point ("WAP") that provides client devices 
24 access to network 12. The use of wireless access point 20 to provide client devices 
24 access to network 10 does not support a contention that server 16 corresponds to 
the claimed "wireless access device," at least because one of ordinary skill would 
recognize that a server is not a "wireless access device." The Examiner states that one 
of ordinary skill "can look at WAP of Fig. 1 and apply the method to a wireless device" 
(Final Office Action at page 2). However, as stated above, in Ocepek, WAP 20 is 
merely a wireless access point. WAP 20 of Ocepe/c does not have a corresponding 
stored "operating system." There is no teaching or suggestion in Ocepe/f of "comparing 
the determined operating system with one or more stored operating systems, such that 
at least one of the stored operating systems corresponds to the wireless access 
device," as recited in claim 2. 

In addition, Ocepek does not teach or suggest the claimed "searching the 
identifiers, wherein a more frequently encountered predetermined percentage of 
identifiers is searched first," as further recited in claim 2. Indeed, the Examiner does not 
rely on OcepekXo teach this element. 

Gray does not cure any of the deficiencies of Ocepek. Gray discloses "WLAN air 
space mapping" (col. 3, lines 8-9). Gray does not teach or suggest "searching the 
identifiers, wherein a more frequently encountered predetermined percentage of 
identifiers is searched first," as recited in claim 2. Indeed, the Examiner does not rely 
on Gray to teach this element. 
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Jennings does not cure the deficiencies of Ocepek and Gray. Jennings discloses 
"the use of a specific or dedicated engine to execute the algorithm" (col. 2, lines 50-51). 
The Examiner states that the LRU in Jennings "stores [a] percentage of total look-ups in 
the LRU engine, this is predetemnined as only the most frequently looked up MAC 
addresses are stored in the LRU engine" (Final Office Action at page 4). Appellant 
disagrees with the Examiner's statement for at least two reasons. 

First, the LRU scheme in Jennings "tunes a look-up database over time so as the 
most frequently used MAC addresses move to the start of the linked lists" (col. 5, lines 
50-52). Jennings clearly only discloses moving MAC addresses to the start of the lists. 
However, the MAC addresses in Jennings cannot correspond to the claimed "identifiers" 
at least because the "identifiers . . . comprise the first three octets of one or more 
registered addresses." Even assuming that the MAC addresses in Jennings correspond 
to the claimed "registered addresses," which Appellant does not concede, the MAC . 
addresses cannot also correspond to the claimed "identifiers." Therefore, Jennings can 
only search for MAC addresses and does not search for "identifiers that comprise the 
first three octets of one or more registered addresses," as recited in claim 2. 

Second, Jennings only discloses moving "the most frequently used MAC 
addresses ... to the start of the linked lists" (col. 5, lines 50-52). No "predetemiined 
percentage" is associated with this step. The Examiner states 'Ihls is predetemiined as 
only the most frequently looked up MAC addresses are stored in the LRU engine" 
(Office Action at page 4). Appellant agrees that the most frequently used MAC 
addresses are moved to the start of the linked lists. However, Jennings Is silent 
regarding moving a predetermined percentage of the MAC addresses. Moving 
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frequently used MAC addresses to the start of a list does not teach or suggest 

searching "identifiers, wherein a more frequently encountered predetermined 

percentage of identifiers is searched first," as recited in claim 2. 

The Examiner states that Jennings discloses "most frequently used MAC 

addresses are moved to the start of the linked lists" (Final Office Action at page 2). 

However, as stated above, claim 2 requires searching first for a "more frequently 

encountered predetermined percentage of identifiers." The claimed identifiers are not 

MAC addresses. Moreover, the Examiner continues to incorrectly assert that "entries at 

the beginning of the lisf correspond to a "predetermined percentage of identifiers" (Final 

Office Action at page 2). As previously stated, Jennings does not teach or suggest 

moving a "predetermined percentage of identifiers." On the contrary, Jennings merely 

moves frequently used MAC addresses regardless of any "predetermined percentage" 

considerations. 

Accordingly, combinations of Ocepel<, Gray, and Jennings do not teach or 
suggest the elements of claim 2. Moreover, there is no teaching or suggestion that 
would lead one of ordinary skill in the art to modify the apparatus of Ocepe/c, Gray, and 
Jennings to achieve the combination of claim 2. Thus, as outlined above, the Office 
Action has neither properly determined the scope and content of the cited references 
nor properly ascertained the differences between the cited references and the claimed 
invention. Therefore, no reason has been clearly articulated as to why the claim would 
have been obvious to one of ordinary skill in view of the cited references and a prima 
facie case of obviousness has not been established with respect to claim 2. 
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Thus, claim 2 is allowable for at least these reasons, and claims 3-5, 7, 10, 1 1 
and 16 are also allowable at least due to their dependence from claim 2. 

Independent claims 18, 19, 34, 49, 50, 52, while of different scope, recite 
features similar to those of claim 2 and are thus allowable over Ocepek, Gray, and 
Jennings for at least reasons similar to those discussed above in regard to claim 2. 
Moreover, claims 20-22, 24, 27, 28, 33, 35-37, 39, 42, 43, and 48 are also allowable at 
least due to their dependence from one of claims 19 and 34. 

B. Claims 6. 23. and 38 are not obvious over Oceoek. Gray. Jennings. 
and Moran 

Regarding the rejection of claims 6, 23, and 38, which depend from independent 
claims 2, 1 9, and 34, the Examiner relies on Moran for allegedly disclosing "comparing 
based on determination of whether a portion of the address is similar to a portion of at 
least one of the registered addresses" (Final Office Action at page 17). Even assuming 
this allegation is correct, which Appellant does not concede, Moran fails to cure the 
deficiencies of Ocepek, Gray, and Jenn/nps with respect to the independent claims. 

Therefore, a prima facie case of obviousness has not been established for claims 
6, 23, and 38 and the Examiner should withdraw the rejection of the claims under 
35 U.S.C.§ 103(a). 

C. Claims 8. 25. and 40 are not obvious over Oceoek. Gray. Jennings. 
and Lausier 

Regarding the rejection of claims 8, 25, and 40, which depend from independent 
claims 2, 19, and 34, the Examiner relies on Lausier\or allegedly disclosing 
"determining the operating system at the IP address associated with the address" (Final 
Office Action at page 18). Even assuming this allegation is true, which Appellant does 
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not concede, Lausier iaWs to cure the deficiencies of Ocepek, Gray, and Jennings with 

respect to the independent claims. 

Therefore, a prima facie case of obviousness has not been established for claims 

8, 25, and 40 and the Examiner should withdraw the rejection of the claims under 

35 U.S.C.§ 103(a). 

D. Claims 9. 26. and 41 are not obvious over Ocepek. Gray. Jennings. 
and Tarauini 

Regarding the rejection of claims 9, 26, and 41 , which depend from independent 
claims 2, 19, and 34, the Examiner relies on Tarquini ior allegedly disclosing 
"determining the operating system using an nmap" (Final Office Action at page 18). 
Even assuming this allegation is tme, which Appellant does not concede, Tarquini\a\\s 
to cure the deficiencies of Ocepeli, Gray, Jennings, and Laus/er with respect to the 
independent claims. 

Therefore, a prima facie case of obviousness has not been established for claims 

9, 26, and 41 and the Examiner should withdraw the rejection of the claims under 
35 U.S.C.§ 103(a). 

CONCLUSION 

For at least the reasons given above, pending claims 2-1 1,16, 18-28, 33-43, 
48-50, and 52 are allowable over the applied references. Therefore, Appellant 
respectfully requests the Board to reverse the Examiner's rejections of claims 2-11,1 6, 
18-28, 33-43, 48-50, and 52. 

To the extent any extension of time under 37 C.F.R. § 1.136 is required to obtain 
entry of this Appeal Brief, such extension is hereby respectfully requested. If there are 
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any fees due under 37 C.F.R. §§ 1 .16 or 1 .17 wlilch are not enclosed herewith, 

including any fees required for an extension of time under 37 C.F.R. § 1 .136, please 

charge such fees to our Deposit Account No. 06-0916. 

Respectfully submitted, 

FINNEGAN, HENDERSON, FARABOW, 
GARREJT & DUNnJr, LLP. 

Dated: May 3, 2010 

Jeffrey A. Berkowitz 
Reg. No. 36,743 

Philip J. Hoffmann 
Registration No. 46,340 
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VIII. Claims Appendix to Appeal Brief Under Rule 41.37fc)nWviin 

2. A method for detecting a wireless access device on a network, the method 
comprising: 

storing one or more organizationally unique identifiers that comprise the first 
three octets of one or more registered addresses; 

receiving from the network a packet with an address; 

searching the identifiers, wherein a more frequently encountered predetermined 
percentage of identifiers is searched first; 

comparing the first three octets of the received address with the identifiers; 

determining If the received address includes one of the stored identifiers; 

determining an operating system associated with the received address, when 
comparing the received address results in a match between the received address and 
at least one of the registered addresses; 

comparing the determined operating system with one or more stored operating 
systems, such that at least one of the stored operating systems corresponds to the 
wireless access device; and 

indicating that the received packet corresponds to the wireless access device 
based on the first three octets of the received address and when the determined 
operating system matches at least one of the stored operating systems. 

3. The method of claim 2, wherein said receiving further comprises: receiving the 
address with infomnation identifying a source of the packet. 
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4. The method of claim 3, further comprising: 

using an organizationally unique identifier as the infomiation identifying the 

source. 

5. The method of claim 2, wherein said receiving further comprises: 
receiving the address based on passively monitoring the network. 

6. The method of claim 2, wherein comparing the address further comprises: 
determining whether a portion of the address is similar to a portion of at least one 

of the registered addresses. 

7. The method of claim 2, wherein comparing the address further comprises: 
determining whether a first organizationally unique identifier of the address is 

similar to a second organizationally unique identifier of at least one of the registered 
addresses. 

8. The method of claim 2, wherein determining the operating system further 
comprises: 

determining the operating system at the Internet Protocol address associated 
with the address. 
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9. The method of claim 8, wherein determining the operating system further 
comprises: 

determining the operating system using an nmap. 

10. The method of claim 2, wherein said indicating further comprises: 
indicating the wireless access device is not authorized on the network. 

1 1 . The method of claim 2, further comprising: 

storing the one or more registered addresses, such that the one or more 
registered addresses are searchable. 

16. The method of claim 2, further comprising: 

storing the stored operating systems, such that a more frequently encountered 
stored operating system is searched before a less frequently encountered stored 
operating system. 

18. A system for detecting a wireless access device on a network, the system 
comprising: 

means for storing one or more organizationally unique identifiers that comprise 
the first three octets of one or more registered addresses; 

means for receiving from the network a packet with an address; 

means for searching the identifiers, wherein a more frequently encountered 
predetermined percentage of identifiers is searched first; 



28 



Application No. 10/645,388 
Attorney Docket No. 03-8005 
Customer No. 25,537 

means for comparing the first three octets of the received address with the 

identifiers; 

means for determining if the received address includes one of the stored 

identifiers; 

means for detennining an operating system associated with the received 
address, when comparing the received address results in a match between the received 
address and at least one of the registered addresses; 

means for comparing the determined operating system with one or more stored 
operating systems, such that at least one of the stored operating systems corresponds 
to the wireless access device; and 

means for indicating that the received packet corresponds to the wireless access 
device based on the first three octets of the received address and when the determined 
operating system matches at least one of the stored operating systems. 

1 9. A system for detecting a wireless access device on a network, the system 
comprising: 

at least one memory comprising: 

code that stores one or more organizationally unique identifiers that comprise the 
first three octets of one or more registered addresses; 

code that receives from the network a packet with an address; 

code that searches the identifiers, wherein a more frequently encountered 
predetemnined percentage of identifiers is searched first; 
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code that compares the first three octets of the received address with the 

identifiers; 

code that detemriines if the received address includes one of the stored 
identifiers; 

code that determines an operating system associated with the received address, 
when comparing the address results in a match between the received address and at 
least one of the registered addresses; 

code that compares the detemriined operating system with one or more stored 
operating systems, such that at least one of the stored operating systems corresponds 
to the wireless access device; and 

code that indicates that the received packet corresponds to the wireless access 
device based on the first three octets of the received address and when the determined 
operating system matches at least one of the stored operating systems; and 

at least one data processor that executes the code. 

20. The system of claim 19, wherein said code that receives further comprises: 
code that receives the address with infomiation identifying a source of the 

packet. 

21 . The system of claim 20, further comprising: 

code that uses an organizationally unique identifier as the information identifying 
the source. 
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22. The system of claim 19, wherein said code that receives further comprises: 
code that receives the address based on passively monitoring the network. 

23. The system of claim 19, wherein code that compares the address further 
comprises: 

code that determines whether a portion of the address is similar to a portion of at 
least one of the registered addresses. 

24. The system of claim 19, wherein said code that compares the address further 
comprises: 

code that determines whether a first organizationally unique identifier of the 
address is similar to a second organizationally unique identifier of at least one the 
registered addresses. 

25. The system of claim 19, wherein said code that determines the operating 
system further comprises: 

code that detemiines the operating system at the internet Protocol address 
associated with the address. 

26. The system of claim 25, wherein said code that detemiines the operating 
system further comprises: 

code that detemnining the operating system using an nmap. 
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27. The system of claim 19, wherein said code that indicates further comprises: 
code that indicates the wireless access device is not authorized on the network. 

28. The system of claim 19, further comprising: 

code that stores the one or more registered addresses, such that the one or 
more registered addresses are searchable. 

33. The system of claim 19, further comprising: 

code that stores the stored operating s^tems, such that a more frequently 
encountered stored operating system is searched before a less frequently encountered 
stored operating system. 

34. A computer program product, tangibly embodied in a computer-readable 
storage medium, for detecting a wireless access device on a network, the computer 
program product comprising: 

code that stores one or more organizationally unique identifiers that comprise the 
first three octets of one or more registered addresses; 

code that receives from the network a packet with an address; 

code that searches the identifiers, wherein a more frequently encountered 
predetermined percentage of identifiers is searched first; 

code that compares the first three octets of the received address with the 
identifiers; 
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code that determines if the received address includes one of the stored 

identifiers; 

code that determines an operating system associated with the received address, 
when comparing the address results in a match between the received address and at 
least one of the registered addresses; 

code that compares the determined operating system with one or more stored 
operating systems, such that at least one of the stored operating systems corresponds 
to the wireless access device; and 

code that indicates that the received packet corresponds to the wireless access 
device based on the first three octets of the received address and when the detennined 
operating system matches at least one of the stored operating systems; and 

at least one data processor that executes the code. 

35. The computer program product of claim 34, wherein said code that receives 
further comprises: 

code that receives the address with information identifying a source of the 
packet. 

36. The computer program product of claim 35, further comprising: code that 
uses an organizationally unique identifier as the information identifying the source. 

37. The computer program product of claim 34, wherein said code that receives 
further comprises: 
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code that receives the address based on passively monitoring the network. 

38. The computer program product of claim 34, wherein code that compares the 
address further comprises: 

code that determines whether a portion of the address is similar to a portion of at 
least one of the registered addresses. 

39. The computer program product of claim 34, wherein said code that compares 
the address further comprises: 

code that determines whether a first organizationally unique identifier of the 
address is similar to a second organizationally unique identifier of at least one of the 
registered addresses. 

40. The computer program product of claim 34, wherein said code that 
determines the operating system further comprises: 

code that determines the operating system at the Intemet Protocol address 
associated with the address. 

41 . The computer program product of claim 34, wherein said code that 
determines the operating system further comprises: 

code that detemnines the operating system using an nmap. 
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42. The computer program product of claim 34, wherein said code that indicates 
further comprises: 

code that indicates the wireless access device is not authorized on the network. 

43. The computer program product of claim 34, further comprising; 

code that stores the one or more registered addresses, such that the one or 
more registered addresses are searchable. 

48. The computer program product of claim 34, further comprising: 

code that stores the stored operating systems, such that a more frequently 
encountered stored operating system is searched before a less frequently encountered 
stored operating system. 

49. A system comprising: 
a network; and 

a processor connected to the network, the processor comprising: 

means for storing one or more organizationally unique identifiers that comprise 

the first three octets of one or more registered addresses; 

means for receiving a packet with an address from a wireless access device on 

the network; 

means for searching the identifiers, wherein a more frequently encountered 
predetemnined percentage of identifiers is searched first; 
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means for comparing the first three octets of the received address with the 

identifiers; 

means for detemiining if the received address includes one of the stored 
identifiers; 

means for determining an operating system associated with the received 
address, when comparing the received address results in a match between the received 
address and at least one of the registered addresses; 

means for comparing the determined operating system with one or more stored 
operating systems, such that at least one of the stored operating systems corresponds 
to the wireless access device; and 

means for indicating that the received packet corresponds to the wireless access 
device based on the first three octets of the received address and when the determined 
operating system matches at least one of the stored operating systems. 

50. A system comprising: 
a network; 

a first processor interfaced to the network; and 

a second processor interfaced to the network, wherein the second processor: 

stores one or more organizationally unique identifiers that comprise the first three 
octets of one or more registered addresses; 

receives a packet with an address from the first processor via the network; 

searches the identifiers, wherein a more frequently encountered predetermined 
percentage of identifiers is searched first; 
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compares the first three octets of the received address with the identifiers; 

determines if the received address includes one of the stored identifiers; 

determines an operating system associated with the received address, when 
comparing the received address results in a match between the received address and 
at least one of the registered addresses; 

compares the determined operating system with one or more stored operating 
systems, such that at least one of the stored operating systems corresponds to an 
operating system of the first processor; and 

indicates that the first processor con-esponds to a wireless access device based 
on the first three octets of the received address and when the determined operating 
system matches at least one of the stored operating systems. 

52. A computer program product, tangibly embodied in a computer-readable 
storage medium, for detecting a wireless access device on a network and containing 
instructions which, when executed on a processor, perform a method comprising: 

storing one or more organizationally unique identifiers that comprise the first 
three octets of one or more registered addresses; 

receiving from the network a packet with an address; 

searching the identifiers, wherein a more frequently encountered predetermined 
percentage of identifiers is searched first; 

comparing the first three octets of the received address with the identifiers; 
determining if the received address includes one of the stored identifiers; 
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determining an operating system associated with the received address, when 
comparing the received address results in a match between the received address and 
at least one of the registered addresses; 

comparing the determined operating system with one or more stored operating 
systems, such that at least one of the stored operating systems corresponds to the 
wireless access device; and 

indicating that the received packet corresponds to the wireless access device 
based on the first three octets of the received address and when the determined 
operating system matches at least one of the stored operating systems. 
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IX. Evidence Appendix to Appeal Brief Under Rule 41.37fc)f1)fixl 

None. 
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X. Related Proceedings Appendix to Appeal Brief Under Rule 41 .syfc^fl Vx^ 

None. 



40 



